Cybersecurity Glossary

Unauthorized access to a user account by exploiting stolen credentials.

A prolonged, targeted cyberattack by a sophisticated, often state-sponsored threat actor.

The total set of points where an attacker can attempt to enter or extract data from an environment.

A network of compromised computers controlled remotely by a threat actor.

An attack method that systematically tries all possible password combinations until the correct one is found.

A social engineering attack that impersonates executives or vendors to authorize fraudulent transactions.

The theft and fraudulent use of payment card information, typically obtained from data breaches.

A compiled file of username/email and password pairs aggregated from multiple data breaches.

Infrastructure used by threat actors to remotely communicate with and control compromised systems.

Automated injection of stolen username/password pairs to gain unauthorized access to accounts.

Underground online communities where threat actors buy, sell, and exchange stolen data, tools, and services.

Encrypted, anonymized parts of the internet accessible only via specialized tools like Tor, used by both privacy advocates and cybercriminals.

Continuous surveillance of dark web sources to detect when an organization's data or credentials have been exposed.

A security incident in which protected or confidential data is accessed, stolen, or disclosed without authorization.

Unintentional exposure of sensitive data, often due to misconfiguration rather than a malicious attack.

The act of researching and publicly exposing private information about an individual without consent.

Security technology that continuously monitors endpoints to detect and respond to cyber threats.

The unauthorized transfer of data from a system or network to a location controlled by an attacker.

Code or a technique that takes advantage of a software vulnerability to cause unintended behavior.

API keys, tokens, passwords, or credentials accidentally committed to public code repositories.

A security discipline focused on detecting and responding to attacks targeting digital identities.

Forensic artifacts that indicate a system may have been breached or is actively under attack.

Malware designed to silently harvest credentials, cookies, and sensitive data from infected devices.

A cybercriminal who specializes in breaching networks and selling that access to other threat actors.

Malware or hardware that records keystrokes to capture passwords and sensitive information.

Techniques used by attackers to progressively move through a network after initial compromise.

Any software intentionally designed to cause harm, disrupt, or gain unauthorized access to systems.

A security mechanism requiring two or more forms of verification before granting access.

Intelligence gathered from publicly available sources including websites, social media, and public records.

An attack that tries a single common password against many accounts to avoid lockout detection.

Techniques attackers use to maintain access to a compromised system across reboots and credential changes.

A social engineering attack using deceptive emails or messages to steal credentials or deliver malware.

Gaining higher levels of access than originally authorized within a system or network.

Malware that encrypts victim data and demands payment for the decryption key.

The initial phase of an attack where threat actors gather information about a target.

A centralized team and facility responsible for monitoring, detecting, and responding to cybersecurity threats.

Taking over an authenticated user session by stealing the session token or cookie.

A platform that aggregates and correlates security event logs to detect threats and support incident response.

Psychological manipulation of people into performing actions or divulging confidential information.

A targeted phishing attack customized with personal details to deceive a specific individual or organization.

A structured package of data harvested by infostealer malware from a single infected device.

An attack that targets a less-secure element in a supply chain to compromise the ultimate target organization.

Any individual or group that carries out or has the intent to carry out malicious cyber activities.

Proactive, human-led search for threats that have evaded automated detection within an environment.

Evidence-based knowledge about existing or emerging threats that informs security decisions.

Cybersecurity risks introduced through vendors, partners, and other third parties with access to your systems or data.

A weakness in software, hardware, or a process that can be exploited by a threat actor.

A vulnerability that is unknown to the software vendor and has no available patch.